nipper Features
===============

nipper currently supports the following device types:

   * Cisco IOS-based Switches
   * Cisco IOS-based Routers
   * Cisco IOS-based Catalysts
   * Cisco NMP-based Catalysts
   * Cisco CatOS-based Catalysts
   * Cisco PIX-based Firewalls
   * Cisco ASA-based Firewalls
   * Cisco FWSM-based Firewalls
   * Cisco CSS-based Content Service Switches
   * Juniper NetScreen ScreenOS-based Firewalls

nipper performs a security audit of a device and produces a report which
can include the following sections:

   * Security Related Issues
       > Introduction
       > The issues
   * Configuration Report
       > Introduction
       > The configuration
   * Appendix Section
       > Abbreviations
       > Timezones
       > Common Ports
       > Logging Severity Levels
       > Version Details

Reports can be output in HTML (default), XML, Latex and plain text formats.

During a security audit nipper can test passwords and connection timeouts,
these can be configured from the command line. The configurable options are:

  * Timeout
  * Minimum Password Length
  * Passwords must contain upper case characters
  * Passwords must contain lower case characters
  * Passwords must contain numbers
  * Passwords must contain special characters
  * Passwords can contain upper or lower case characters
  * Dictionary for testing against passwords

nipper will decode Cisco type 7 passwords, other passwords can be output to
a john-the-ripper file for further testing.

nipper includes support for a variety of different device types and gathers
a lot of information whilst performing a security audit. However, nipper
does not gather all information from a device configuration. This document
describes what information is used and what security issues nipper identifies.


IOS-Based Configuration Settings
--------------------------------

  * Hostname
  * IOS Version
  * Timezone and offsets
  * Authorative Time Source
  * Service Password Encryption
  * Minimum Password Length
  * IP Source Routing
  * Bootp
  * Service Config
  * TCP Keep Alives
  * Cisco Express Forwarding
  * Gratuitous ARP
  * Classless Routing
  * Domain Name
  * Domain Lookup
  * DNS Servers
  * Enable Passwords
  * Users
  * Privilages
  * Banner
  * Telnet
  * SSH
  * HTTP
  * Finger
  * TCP / UDP Small Services
  * NTP
  * SNMP 1, 2 and 3
  * CDP
  * PAD
  * Logging
  * Syslog
  * Buffered Logging
  * Terminal Logging
  * FTP
  * TACACS
  * AAA
  * BGP
  * VRRP
  * EIGRP
  * RIP
  * OSPF
  * Routes
  * Route Maps
  * Keys and Key Chains
  * Lines
  * Interfaces
  * VTP
  * Switch Ports
  * NAT (All types)
  * ACL (All types)


IOS-Based Security Issues
-------------------------

  * Software Versions
  * Dictionary-Based / Default Passwords
  * Weak Passwords
  * Auto-Configuration
  * IP Directed Broadcasts
  * BGP Route Dampening
  * OSPF Authentication
  * EIGRP Authentication
  * RIP Authentication
  * VRRP Authentication
  * TCP Keep Alives
  * Connection Timeouts
  * AUX Port
  * Source Routing
  * Finger
  * HTTP
  * SNMP Version 1 / 2
  * Telnet
  * Redirects
  * Access Lists
  * uRPF Verification
  * Switch Port Mode
  * Switch Port Security
  * Logging
  * Proxy ARP
  * SSH Protocol Version
  * CDP
  * Classless Routing
  * Minimum Password Length
  * Bootp
  * TCP / UDP Small Servers
  * IP Unreachables
  * IP Mask Reply
  * Enable Secret
  * Password Encryption
  * Banners
  * Domain Lookup
  * PAD
  * MOP


PIX/ASA/FWSM-Based Configuration Settings
-----------------------------------------

  * Hostname
  * Domain Name
  * Version
  * Transparent Firewall
  * Enable Password
  * Users
  * SSH
  * Interfaces
  * NAT / PAT
  * Routing
  * Access Control Lists
  * ICMP Access
  * Protocol Analysis
  * Group Objects
  * Name Mappings


PIX/ASA/FWSM-Based Security Issues
----------------------------------

  * Connection Timeouts
  * Access Control Lists
  * SSH Protocol Version


CSS-Based Configuration Settings
--------------------------------

  * Hostname (a little hack, recommend specifying)
  * CSS Version
  * FTP Server
  * SNMP
  * SSH Server
  * Telnet Server
  * Web Management Server
  * Access Control Lists


CSS-Based Security Issues
-------------------------

  * SNMP
  * Telnet
  * Access Control Lists


CatOS/NMP-Based Configuration Settings
--------------------------------------

  * Hostname
  * NMP Version
  * Location
  * Contact
  * Core Files
  * Syslog Files
  * Idle Session Timeout
  * Port Security Auto Configure
  * Enable Passwords
  * Login Passwords
  * ICMP Redirects
  * IP Unreachables
  * IP Fragmentation
  * CDP
  * SNMP
  * Permit Lists
  * VLAN Configuration


CatOS/NMP-Based Security Issues
-------------------------------

  * Dictionary-Based / Default Passwords
  * Weak Passwords
  * Connection Timeouts
  * IP Redirects
  * CDP
  * IP Unreachables


ScreenOS-Based Configuration Settings
-------------------------------------

  * Hostname
  * Administrative Settings
  * Users
  * Alerting
  * Timeouts
  * Authentication Server
  * Admin Privilages
  * SSH
  * Interfaces
  * Policies
  * Name Lists


ScreenOS-Based Security Issues
------------------------------

  * Policies
  * Connection Timeout
  * Administrative HTTP Redirect
  * Management IP Address



 ***************************************************************************
 *   nipper - The network infrastructure parser                            *
 *   Copyright (C) 2006 - 2007 by Ian Ventura-Whiting (Fizz)               *
 *   fizz@titania.co.uk                                                    *
 *                                                                         *
 *   This program is free software; you can redistribute it and/or modify  *
 *   it under the terms of the GNU General Public License as published by  *
 *   the Free Software Foundation; either version 3 of the License, or     *
 *   (at your option) any later version.                                   *
 *                                                                         *
 *   This program is distributed in the hope that it will be useful,       *
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
 *   GNU General Public License for more details.                          *
 *                                                                         *
 *   You should have received a copy of the GNU General Public License     *
 *   along with this program. If not, see <http://www.gnu.org/licenses/>.  *
 ***************************************************************************